shop manager registration

I have a high profile client who gets a lot of traffic. some good, some not so good. She’s very controversial and recently noticed a user registration for a user who was assigned shop manager role. Might there be a vulnerability? The sight is configured to so as to not enable user registrations. The only users who get registered are those who use the Woo store. Anyone else see this? Insights? Suggestions?

https://wordpress.org/plugins/woocommerce/